Ktor testing routes with 'authenticate(){}'

What is the appropriate way of unit testing such routes?

fun Application.install() {
    routing {
        route("point") {
            authenticate(AUTH_SESSION) {
                post("/test") { testController.test(context) }
            }
        }
    }
}

The problem is such routes require auth info. This code results in 401 error:

@Test
fun `test auth route`() = testApplication {
    val client = client()
    client.post("/point/test")
}

I use GoogleOneTap auth for a mobile application. From GoogleOneTap jwt token I generate User session with a Bearer. That session expires after some time.
So, such a test user requires manual auth each time session expires? If so, it's not appropriate for a CI.

Should I implement a simple auth with user-password and call auth before each call under authenticate(AUTH_SESSION)?

Finally, I got it:

1. Read through ktor docs https://ktor.io/docs/testing.html
2. With any auth you have auth route: post("/auth/myprovider") which gives you bearer cookie

Your routing:

routing {
    // auth route to get a bearer cookie
    post("/auth/google") { googleAuthController.signIn(context) }
    authenticate(AUTH_SESSION) {
        // these routes need auth bearer cookie
        post("/my/route/requiring/auth")
    }
}

post("/my/route/requiring/auth") uses authentication, hence all testing requests have to have auth bearer cookie. To get it, create a separate test user with test credentials:

class GoogleAuthController(
    private val userDao: UserDao
) {

    suspend fun signIn(call: ApplicationCall) {
        val token = call.parameters["token"]!!
        val userInfo: UserInfo? = verifyTestUsers(token) ?: GoogleAuthVerifier.verify(token)
        if (userInfo != null) {
            // create user
            val userSession = UserSession(
                id = userInfo.id,
                email = userInfo.email,
                name = userInfo.name,
                pictureUrl = userInfo.pictureUrl,
                locale = userInfo.locale
            )
            // save user to db
            userDao.saveUserInfoGoogleOneTap(userSession)
            // set user cookie
            call.sessions.set(userSession)
            call.respond(HttpStatusCode.OK)
        } else {
            throw IllegalArgumentException("Invalid token")
        }
    }

    // testUsers: Map<String, UserInfo>
    private fun verifyTestUsers(token: String): UserInfo? = testUsers[token]
}

Basically, this is how you can get a cookie for any of your test users.

Next, to make calls, you need a client:

suspend fun ApplicationTestBuilder.myAuthClient(token: String = testUserToken) = createClient {
    install(HttpCookies)
    install(ContentNegotiation) {
        json(Json {
            prettyPrint = true
            isLenient = true
            ignoreUnknownKeys = true
            encodeDefaults = true
        })
    }
}.also {
    it.post("/auth/google") {
        parameter("token", token)
    }
}

Here on each client creation you call your auth method and get credentials for a test user.

Now you are ready to make authenticated calls:

internal class TestAuth {

    @Test
    fun `test auth`() = testApplication {
        val client = myAuthClient() 
        // here `client` already has a Bearer cookie
        
        val response = client.post("/my/route/requiring/auth")
        assert(response.body<String>().isNotEmpty())
    }
}